DOCSLIB.ORG

Usmernenie K Ukončovaniu Funkčnosti Zásuvných Modulov Vo Webových Prehliadačoch

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Usmernenie K Ukončovaniu Funkčnosti Zásuvných Modulov Vo Webových Prehliadačoch Usmernenie k ukončovaniu funkčnosti zásuvných modulov vo webových prehliadačoch Usmernenie k ukončovaniu funkčnosti zásuvných modulov vo webových prehliadačoch v 1.0 Cieľom tohto dokumentu je informovať o aktuálnom stave rozhraní pre zásuvné moduly vo webových prehliadačoch a zároveň usmerniť správcov obsahu ohľadom súvisiacich povinností vyplývajúcich z Výnosu Ministerstva financií Slovenskej republiky č. 55/2014 Z. z. o štandardoch pre informačné systémy verejnej správy v znení neskorších predpisov (ďalej len „Výnos o štandardoch“). Podnetom pre vznik dokumentu boli viaceré významné zmeny v oblasti webových prehliadačov, ako je napríklad ukončenie funkčnosti rozhrania NPAPI vo webových prehliadačoch Google Chrome a Mozilla Firefox či významné rozšírenie nových prehliadačov bez podpory zásuvných modulov. Zásuvné moduly, ktorých vyžadovanie je v praxi zatiaľ stále pomerne rozšírené, tak nebude možné používať v najpoužívanejších webových prehliadačoch. Dokument pozostáva z informatívnej časti a z časti, ktorá obsahuje pokyny pre verejnú správu. V informatívnej časti dokumentu sú uvedené príklady využitia zásuvných modulov a plánované obmedzovania funkčnosti v jednotlivých prehliadačoch ako aj informácie a odporučenia pre správcov, prevádzkovateľov a dodávateľov webových sídiel o používaných náhradách. Kapitola 4. obsahuje povinnosti pre správcov obsahu webových sídiel súvisiace s ukončovaním funkčnosti zásuvných modulov vo webových prehliadačoch. Verzia dokumentu: 1.0 Dátum účinnosti: November 2015 1 Usmernenie k ukončovaniu funkčnosti zásuvných modulov vo webových prehliadačoch OBSAH: 1. Zásuvné moduly a ich funkcia ............................................................................................... 3 2. Aktuálny stav zásuvných modulov ........................................................................................ 5 2.1 Rozhrania vo webových prehliadačoch pre zásuvné moduly .............................................. 5 2.2 Príklady zásuvných modulov webových prehliadačov a nimi využívaných rozhraní ......... 6 3. Ukončovanie a obmedzovanie funkčnosti zásuvných modulov ............................................ 7 3.1. Vyhlásenia tvorcov prehliadačov k ukončovaniu funkčnosti zásuvných modulov ............ 8 3.2. Príklady zásuvných modulov, ktoré nebudú spustiteľné ................................................... 11 3.3 Náhrady za zásuvné moduly .............................................................................................. 11 3.4 Odporúčania pre vývojárov aplikácií k náhradám za zásuvné moduly .............................. 15 4. Inštrukcie pre verejnú správu ku ukončovaniu funkčnosti zásuvných modulov ................. 17 4.1. Uplatnenie Výnosu o štandardoch na konkrétne oblasti/prípady ...................................... 18 4.1.1. Podpisovanie so zaručeným elektronickým podpisom .................................................. 18 4.1.2 Audio a video .................................................................................................................. 21 4.1.3 Audio a video streaming ................................................................................................. 21 2 Usmernenie k ukončovaniu funkčnosti zásuvných modulov vo webových prehliadačoch 1. Zásuvné moduly a ich funkcia Pre spracovanie a zobrazovanie takého obsahu na webových stránkach, ktorý nie je štandardne podporovaný vo webových prehliadačoch alebo nie je súčasťou webových štandardov, sa dlhodobo (cca od roku 1995) umožňovala inštalácia zásuvných modulov (pluginov) pre webové prehliadače. Pri otvorení webovej stránky obsahujúcej určený formát súboru (media type) sa aktivuje zásuvný modul webového prehliadača, ktorý tento súbor spracúva a výsledok sa obvykle zobrazuje ako súčasť webovej stránky, a to napríklad ako animácia, prehrávač videa, interaktívny objekt a podobne. V prípade niektorých zásuvných modulov sa výsledok otvára v okne danej aplikácie. Zásuvné moduly webových prehliadačov sú obvykle zdieľané knižnice, vytvárajúce pri spracúvaní nimi podporovaného obsahu prepojenie medzi webovým prehliadačom a inou aplikáciou. Umožňujú automaticky spúšťať túto aplikáciu priamo vo webovom prehliadači, pričom sú aktívne keď sa na webovej stránke spracúva nimi podporovaný obsah. Zásuvné moduly sa obvykle musia samostatne poskytovať pre každý operačný systém / platformu a v systéme sa obvykle inštalujú spolu s aplikáciou, ktorá natívne podporuje daný obsah aj nezávisle od webového prehliadača. Príklady zásuvných modulov pre webové prehliadače a nimi spracúvaných súborov: Adobe Flash Player (SWF - media type: application/x-shockwave-flash) Adobe Reader Plugin (PDF - media type: application/pdf) Oracle Java Plugin (JAR, JNLP - media type: application/x-java-applet, application/x-java-vm, application/x-java-bean) Apple QuickTime Plugin (MOV, QT, MP4 - media type: video/quicktime, video/mp4, video/x-m4v) Microsoft Silverlight (XAP, XAML - media type: application/x-silverlight) EstEID Plugin - open source podpisovanie s elektronickým podpisom pre Estónsko (BDOC, DDOC, media type: application/x-digidoc, application/x-esteid, application/x-idcard-plugin). Príklady zásuvných modulov poskytovaných alebo vyžadovaných verejnou správou SR pre používanie elektronických služieb: Autodesk MapGuide Viewer (MWF, mapy - katasterportal.sk) Ditec D.Signer/XAdES .NET (podpisovanie súborov so ZEP - financnasprava.sk, portal.minv.sk, slovensko.sk) Oracle Java Plugin + Ditec D.Signer/XAdES .Java (podpisovanie súborov so ZEP - slovensko.sk ) Disig Web Signer ActiveX alebo Oracle Java Plugin + Disig Web Signer Java (podpisovanie so ZEP, odporúčaný na slovensko.sk ) Adobe Flash Player (slov-lex.sk – na kopírovanie odkazu, nrsr.sk – video archív). 3 Usmernenie k ukončovaniu funkčnosti zásuvných modulov vo webových prehliadačoch Od zásuvných modulov je potrebné odlišovať: a) doplnky webových prehliadačov (add-ons, extensions) a b) klientské aplikácie. Doplnky webových prehliadačov obvykle rozširujú alebo menia funkčnosti samotného prehliadača. Doplnky sú obvykle aktívne neustále počas používania webového prehliadača, zatiaľ čo zásuvné moduly sa aktivujú len v prípade otvorenia webovej stránky obsahujúcej nimi spracúvaný obsah. Doplnky prehliadačov sa obvykle musia vytvoriť samostatne pre každý webový prehliadač, prehliadače totiž pre ne nepoužívajú jednotné rozhranie ako to je v prípade zásuvných modulov vo viacerých prehliadačoch. Je však snaha tvorcov používať pre doplnky v budúcnosti najmä webové technológie, napríklad tvorcovia prehliadačov Firefox a Edge chcú dosiahnuť čo najväčšiu kompatibilitu s doplnkami pre Chrome. Príklady doplnkov: Adblock Flashblock NoScript TabMixPlus. Príklady doplnkov poskytovaných verejnou správou v zahraničí: Belgium eID in Firefox (Belgicko) Token Signing (Estónsko – Chrome) Estonian ID Card PKCS11 module loader (Estónsko - Firefox) EstEID Plugin BHO (Estónsko - Internet Explorer). Klientske aplikácie sa obvykle spúšťajú a používajú bez potreby použitia webového prehliadača, často slúžia na prácu bez nutnosti pripojenia k počítačovej sieti alebo internetu. Niektoré klientske aplikácie však môžu byť špeciálne určené pre spúšťanie v prostredí webového prehliadača. Príklady klientskych aplikácií poskytovaných alebo vyžadovaných verejnou správou SR: aplikácia eDane (financnasprava.sk) aplikácia eID klient (minv.sk) ovládač čítačky čipovej karty IDBridge CT30. Príklady klientskych aplikácií verejnej správy v zahraničí: Estónsko – DigiDoc3 (súčasť balíka ID software pre desktop) mobilná aplikácia DigiDoc pre podpisovanie v Android a iOS Nemecko – PersoApp a AusweisApp. 4 Usmernenie k ukončovaniu funkčnosti zásuvných modulov vo webových prehliadačoch 2. Aktuálny stav zásuvných modulov 2.1 Rozhrania vo webových prehliadačoch pre zásuvné moduly Vo webových prehliadačoch existujú pre zásuvné moduly tieto rozhrania: Rozhranie NPAPI (Netscape Plugin Application Programming Interface) z roku 1995 je dnes používané v desktopových verziách webových prehliadačov Mozilla Firefox, Apple Safari a ďalších, na rôznych desktopových operačných systémoch ako napríklad Windows, OS X, GNU/Linux. Do roku 2014 sa NPAPI používalo aj v Chrome, Chromium a Opere pre GNU/Linux a do roku 2015 v Chrome a Chromium pre Windows, OS X, kedy ukončili jeho funkčnosť. Mozilla plánuje ukončiť funkčnosť NPAPI do konca roka 2016. Apple zatiaľ neoznámila ukončenie funkčnosti NPAPI. Rozhranie ActiveX (COM, OLE) z roku 1996 je používané v desktopovej verzii webového prehliadača Internet Explorer a je funkčné len v MS Windows. Nový prehliadač Microsoft Edge z roku 2015 už ActiveX nepodporuje. Rozhranie PPAPI (Pepper Plugin API) a NaCl (Native Client) z roku 2009 je používané pre zásuvné moduly a aplikácie v desktopovej verzii Chrome, Chromium a Opere, nedá sa však použiť pre tradičné zásuvné moduly. Pre tradičné zásuvné moduly je nevyhnutný ich prístup do systému používateľa, čo je však v prípade PPAPI rozhrania umožnené len pre vybrané „dôveryhodné“ (trusted) zásuvné moduly a aplikácie, ktoré implementujú sandboxové vyčlenenie. Tieto dôveryhodné zásuvné moduly sú často priamo integrované v prehliadači (napríklad Chrome PDF Viewer, PPAPI verzia Flash Playera v Chrome a podobne) alebo sú v prehliadači zaregistrované ako dôveryhodné (napríklad PPAPI Flash Player pre Operu alebo Chromium sa inštaluje samostatne). Zásuvné moduly tretích strán sa nedajú obvyklým spôsobom nainštalovať a použiť ako dôveryhodné. Je to možné len cez špecifické spúšťanie Chrome určené najmä pre vývojárov, čo sa neodporúča. Ide
Load more

Recommended publications
  • Browser Wars
    Uppsala universitet Inst. för informationsvetenskap Browser Wars Kampen om webbläsarmarknaden Andreas Högström, Emil Pettersson Kurs: Examensarbete Nivå: C Termin: VT-10 Datum: 2010-06-07 Handledare: Anneli Edman "Anyone who slaps a 'this page is best viewed with Browser X' label on a Web page appears to be yearning for the bad old days, before the Web, when you had very little chance of read- ing a document written on another computer, another word processor, or another network" - Sir Timothy John Berners-Lee, grundare av World Wide Web Consortium, Technology Review juli 1996 Innehållsförteckning Abstract ...................................................................................................................................... 1 Sammanfattning ......................................................................................................................... 2 1 Inledning .................................................................................................................................. 3 1.1 Bakgrund .............................................................................................................................. 3 1.2 Syfte ..................................................................................................................................... 3 1.3 Frågeställningar .................................................................................................................... 3 1.4 Avgränsningar .....................................................................................................................
    [Show full text]
  • Understanding and Mitigating Attacks Targeting Web Browsers
    Understanding and Mitigating Attacks Targeting Web Browsers A Dissertation presented in partial fulfillment of the requirements for the degree of Doctor of Philosophy in the field of Information Assurance by Ahmet Salih Buyukkayhan Northeastern University Khoury College of Computer Sciences Boston, Massachusetts April 2019 To my family, teachers and mentors. i Contents List of Figures v List of Tables vii Acknowledgments viii Abstract of the Dissertation ix 1 Introduction 1 1.1 Structure of the Thesis . .2 2 Background 4 2.1 Browser Extensions . .4 2.1.1 Firefox Extensions . .5 2.1.2 Extension Security . .7 2.2 Vulnerabilities in Web Applications . .9 2.2.1 Vulnerability Reward Programs and Platforms . .9 2.2.2 XSS Vulnerabilities . 10 2.2.3 XSS Defenses . 12 3 CrossFire: Firefox Extension-Reuse Vulnerabilities 14 3.1 Overview . 14 3.2 Threat Model . 15 3.3 Design . 16 3.3.1 Vulnerability Analysis . 17 3.3.2 Exploit Generation . 19 3.3.3 Example Vulnerabilities . 20 3.4 Implementation . 23 3.5 Evaluation . 23 3.5.1 Vulnerabilities in Top Extensions . 23 3.5.2 Random Sample Study of Extensions . 25 3.5.3 Performance & Manual Effort . 27 ii 3.5.4 Case Study: Submitting an Extension to Mozilla Add-ons Repository . 28 3.5.5 Jetpack Extensions. 30 3.5.6 Implications on Extension Vetting Procedures . 31 3.6 Summary . 31 4 SENTINEL: Securing Legacy Firefox Extensions 33 4.1 Overview . 33 4.2 Threat Model . 34 4.3 Design . 35 4.3.1 Intercepting XPCOM Operations . 36 4.3.2 Intercepting XUL Document Manipulations .
    [Show full text]
  • Security Analysis of Browser Extension Concepts
    Saarland University Faculty of Natural Sciences and Technology I Department of Computer Science Bachelor's thesis Security Analysis of Browser Extension Concepts A comparison of Internet Explorer 9, Safari 5, Firefox 8, and Chrome 14 submitted by Karsten Knuth submitted January 14, 2012 Supervisor Prof. Dr. Michael Backes Advisors Raphael Reischuk Sebastian Gerling Reviewers Prof. Dr. Michael Backes Dr. Matteo Maffei Statement in Lieu of an Oath I hereby confirm that I have written this thesis on my own and that I have not used any other media or materials than the ones referred to in this thesis. Saarbr¨ucken, January 14, 2012 Karsten Knuth Declaration of Consent I agree to make both versions of my thesis (with a passing grade) accessible to the public by having them added to the library of the Computer Science Department. Saarbr¨ucken, January 14, 2012 Karsten Knuth Acknowledgments First of all, I thank Professor Dr. Michael Backes for giving me the chance to write my bachelor's thesis at the Information Security & Cryptography chair. During the making of this thesis I have gotten a deeper look in a topic which I hope to be given the chance to follow up in my upcoming academic career. Furthermore, I thank my advisors Raphael Reischuk, Sebastian Gerling, and Philipp von Styp-Rekowsky for supporting me with words and deeds during the making of this thesis. In particular, I thank the first two for bearing with me since the release of my topic. My thanks also go to Lara Schneider and Michael Zeidler for offering me helpful advice.
    [Show full text]
  • Web Tracking: Mechanisms, Implications, and Defenses Tomasz Bujlow, Member, IEEE, Valentín Carela-Español, Josep Solé-Pareta, and Pere Barlet-Ros
    ARXIV.ORG DIGITAL LIBRARY 1 Web Tracking: Mechanisms, Implications, and Defenses Tomasz Bujlow, Member, IEEE, Valentín Carela-Español, Josep Solé-Pareta, and Pere Barlet-Ros Abstract—This articles surveys the existing literature on the of ads [1], [2], price discrimination [3], [4], assessing our methods currently used by web services to track the user online as health and mental condition [5], [6], or assessing financial well as their purposes, implications, and possible user’s defenses. credibility [7]–[9]. Apart from that, the data can be accessed A significant majority of reviewed articles and web resources are from years 2012 – 2014. Privacy seems to be the Achilles’ by government agencies and identity thieves. Some affiliate heel of today’s web. Web services make continuous efforts to programs (e.g., pay-per-sale [10]) require tracking to follow obtain as much information as they can about the things we the user from the website where the advertisement is placed search, the sites we visit, the people with who we contact, to the website where the actual purchase is made [11]. and the products we buy. Tracking is usually performed for Personal information in the web can be voluntarily given commercial purposes. We present 5 main groups of methods used for user tracking, which are based on sessions, client by the user (e.g., by filling web forms) or it can be collected storage, client cache, fingerprinting, or yet other approaches. indirectly without their knowledge through the analysis of the A special focus is placed on mechanisms that use web caches, IP headers, HTTP requests, queries in search engines, or even operational caches, and fingerprinting, as they are usually very by using JavaScript and Flash programs embedded in web rich in terms of using various creative methodologies.
    [Show full text]
  • How to Download Flash Videos Firefox
    How to download flash videos firefox Download Flash and Video is a great download helper tool that lets you download Flash games and Flash videos (YouTube, Facebook, ​Download Flash and Video · ​ user reviews · ​Versions. Flash Video Downloader - YouTube HD Download [4K] Flash Video Downloader helps you find links to videos, pictures, audio and. Download all the links, movies and audio clips of a page at the maximum speed with a single click, using the most Supported download tools are dozens, see for details. Download Management · Photos, Music & Videos ​ user reviews · ​Versions · ​Developer:: Add. The easy way to download and convert Web videos from hundreds of Video DownloadHelper is the most complete tool to extract videos and. Many websites require the Adobe Flash Player plugin to display videos and games. Learn how to install the Flash Go to Adobe's Flash Player download page. Issues with Flash, which YouTube uses to play videos, may cause Read More. It is not even Download Flash Files Using Firefox. Launch Firefox and load to. This short video will show you how to download any flash video including youtube videos using a free. Install DownloadHelper in Firefox. One of the easiest ways to download YouTube videos is with the. check You can also install and use a Firefox add-on like FlashGot (see resources) to download Flash and other types of files to your hard drive. I wanted to download some quilting videos from YouTube so that I always had them available whenever I needed to remind myself how to do a. Also Orbit Downloader can help you to download flash videos and clips from many video sharing websites like YouTube, Metacafe, Dailymotion, Myspace.
    [Show full text]
  • Pipenightdreams Osgcal-Doc Mumudvb Mpg123-Alsa Tbb
    pipenightdreams osgcal-doc mumudvb mpg123-alsa tbb-examples libgammu4-dbg gcc-4.1-doc snort-rules-default davical cutmp3 libevolution5.0-cil aspell-am python-gobject-doc openoffice.org-l10n-mn libc6-xen xserver-xorg trophy-data t38modem pioneers-console libnb-platform10-java libgtkglext1-ruby libboost-wave1.39-dev drgenius bfbtester libchromexvmcpro1 isdnutils-xtools ubuntuone-client openoffice.org2-math openoffice.org-l10n-lt lsb-cxx-ia32 kdeartwork-emoticons-kde4 wmpuzzle trafshow python-plplot lx-gdb link-monitor-applet libscm-dev liblog-agent-logger-perl libccrtp-doc libclass-throwable-perl kde-i18n-csb jack-jconv hamradio-menus coinor-libvol-doc msx-emulator bitbake nabi language-pack-gnome-zh libpaperg popularity-contest xracer-tools xfont-nexus opendrim-lmp-baseserver libvorbisfile-ruby liblinebreak-doc libgfcui-2.0-0c2a-dbg libblacs-mpi-dev dict-freedict-spa-eng blender-ogrexml aspell-da x11-apps openoffice.org-l10n-lv openoffice.org-l10n-nl pnmtopng libodbcinstq1 libhsqldb-java-doc libmono-addins-gui0.2-cil sg3-utils linux-backports-modules-alsa-2.6.31-19-generic yorick-yeti-gsl python-pymssql plasma-widget-cpuload mcpp gpsim-lcd cl-csv libhtml-clean-perl asterisk-dbg apt-dater-dbg libgnome-mag1-dev language-pack-gnome-yo python-crypto svn-autoreleasedeb sugar-terminal-activity mii-diag maria-doc libplexus-component-api-java-doc libhugs-hgl-bundled libchipcard-libgwenhywfar47-plugins libghc6-random-dev freefem3d ezmlm cakephp-scripts aspell-ar ara-byte not+sparc openoffice.org-l10n-nn linux-backports-modules-karmic-generic-pae
    [Show full text]
  • Open An-Open-Web.Pdf
    AN OPEN WEB Copyright : The Contributors (see back) Published : 2011-01-30 License : None Note : We offer no warranty if you follow this manual and something goes wrong. So be 1 careful! Introduction 1. The Web is Closed 2. The Future is Open 2 1. THE WEB IS CLOSED “As much as we love the open Web, we’re abandoning it.” -Chris Anderson, WIRED Magazine The Web was meant to be Everything. As the Internet as a whole assumes an increasingly commanding role as the technology of global commerce and communication, the World Wide Web from its very inception was designed to be a free and open medium through which human knowledge is created, accessed and exchanged.1 But, that Web is in danger of coming to a close. The Web was meant to be Free. It laid out a language of HyperText, which anyone could use to author electronic documents and connect them together with links. The documents in totum were meant to form a global web of information with no center and no single point of control.2 The first Web browser was also a Web editor, and this principle that any node in the network can both consume and create content has more or less been defended to this day. The Web was meant to be Open. It detailed a common interface that could be implemented on any computer. This innovation overcame the obstacles of incompatible platforms and tools for the sharing of knowledge on the Net,3 by defining a Hypertext Transfer Protocol (HTTP) and other standards for the discovery and communication of online data.
    [Show full text]
  • Protecting Browsers from Extension Vulnerabilities
    Protecting Browsers from Extension Vulnerabilities Adam Barth, Adrienne Porter Felt, Prateek Saxena Aaron Boodman University of California, Berkeley Google, Inc. fabarth, afelt, [email protected] [email protected] Abstract browser’s full privileges. If an attacker can exploit an ex- tension vulnerability, the attacker can usurp the extension’s Browser extensions are remarkably popular, with one in broad privileges and install malware on the user’s machine. three Firefox users running at least one extension. Although At this year’s DEFCON, Liverani and Freeman presented well-intentioned, extension developers are often not security attacks against a number of popular Firefox extensions [24]. experts and write buggy code that can be exploited by ma- In one example, if the user dragged an image from a mali- licious web site operators. In the Firefox extension system, cious web page into the extension, the web site operator these exploits are dangerous because extensions run with could install a remote desktop server on the user’s machine the user’s full privileges and can read and write arbitrary and take control of the user’s mouse and keyboard. files and launch new processes. In this paper, we analyze These attacks raise the question of whether browser ex- 25 popular Firefox extensions and find that 88% of these tensions require such a high level of privilege. To investi- extensions need less than the full set of available privileges. gate this question, we examine 25 popular Firefox exten- Additionally, we find that 76% of these extensions use un- sions to determine how much privilege each one requires.
    [Show full text]
  • Chrome Extensions: Threat Analysis and Countermeasures
    Chrome Extensions: Threat Analysis and Countermeasures Lei Liu∗ Xinwen Zhang Vuclip Inc. Huawei R&D Center Milpitas,CA95035 SantaClara,CA95050 [email protected] [email protected] GuanhuaYan SongqingChen Los Alamos National Laboratory George Mason University LosAlamos,NM87545 Fairfax,VA22030 [email protected] [email protected] Abstract user experience, a large number of browser extensions have been developed by browser vendors or third party develop- The widely popular browser extensions now become one ers. The wide popularity of browser extensions has attracted of the most commonly used malware attack vectors. The the attention of attackers. A recent study [25] shows that Google Chrome browser, which implements the principles nowadays many malware infections are in the form of add- of least privileges and privilege separation by design, of- ons on popular web browsers like IE and a majority of mal- fers a strong security mechanism to protect malicious web- ware have a browser extension implementation. Browser sites from damaging the whole browser system via exten- helper objects (BHOs), a widely used type of add-ons, is sions. In this study, we however reveal that Chrome’s ex- named by CERT [24] as one of the techniques that are most tension security model is not a panacea for all possible at- frequently employed by spyware writers. tacks with browser extensions. Through a series of prac- The threats posed by malicious browser extensions call tical bot-based attacks that can be performed even under for a thorough investigation of the security models that web typical settings, we demonstrate that malicious Chrome ex- browsers use to execute these extensions.
    [Show full text]
  • Clicksafe: Providing Security Against Clickjacking Attacks
    CLICKSAFE : PROVIDING SECURITY AGAINST CLICK JACKING ATTACKS Jawwad A. Shamsi #1 , Sufian Hameed #2, Waleed Rahman #3 , Farooq Zuberi #4 , Kaiser Altaf #5 , Ammar Amjad #6 #C.S Dept., National University of Computer and Emerging Sciences – Karachi Campus ST-4 Sector 17-D, on National Highway, Karachi, Pakistan (021) 111-128-128 [email protected] , [email protected] , [email protected] [email protected] , [email protected] , [email protected] Abstract – Clickjacking is an act of hijacking user clicks in which contained a link to the malicious website itself, is order to perform unintended actions that is advantageous for the posted on the user’s behalf. attacker. We propose Clicksafe, a browser-based tool to provide Clcikjacking can also be implemented by simply hiding increased security and reliability against clickjacking attacks. single UI elements, rather than the whole page in an IFRAME. Clicksafe is based on three major components. The detection unit Likejacking attacks [5] and Tapjacking attacks [6] are detects malicious components in a webpage that redirect users to examples of such link of attacks. While tapjacking is related external links. The mitigation unit provides interception of user to mobiles but since the main area of attack are browsers, clicks and give educated warnings to users who can then choose mobile are also susceptible to clickjacking type attacks. For to continue or not. Clicksafe also incorporate a feedback unit which records the user’s actions, converts them into ratings and finding a solution that will be applicable to all, our description allows future interactions to be more informed.
    [Show full text]
  • Designing for Extensibility and Planning for Conflict
    Designing for Extensibility and Planning for Conflict: Experiments in Web-Browser Design Benjamin S. Lerner A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy University of Washington 2011 Program Authorized to Offer Degree: UW Computer Science & Engineering University of Washington Graduate School This is to certify that I have examined this copy of a doctoral dissertation by Benjamin S. Lerner and have found that it is complete and satisfactory in all respects, and that any and all revisions required by the final examining committee have been made. Chair of the Supervisory Committee: Daniel Grossman Reading Committee: Daniel Grossman Steven Gribble John Zahorjan Date: In presenting this dissertation in partial fulfillment of the requirements for the doctoral degree at the University of Washington, I agree that the Library shall make its copies freely available for inspection. I further agree that extensive copying of this dissertation is allowable only for scholarly purposes, consistent with “fair use” as prescribed in the U.S. Copyright Law. Requests for copying or reproduction of this dissertation may be referred to Proquest Information and Learning, 300 North Zeeb Road, Ann Arbor, MI 48106-1346, 1-800-521-0600, to whom the author has granted “the right to reproduce and sell (a) copies of the manuscript in microform and/or (b) printed copies of the manuscript made from microform.” Signature Date University of Washington Abstract Designing for Extensibility and Planning for Conflict: Experiments in Web-Browser Design Benjamin S. Lerner Chair of the Supervisory Committee: Associate Professor Daniel Grossman UW Computer Science & Engineering The past few years have seen a growing trend in application development toward “web ap- plications”, a fuzzy category of programs that currently (but not necessarily) run within web browsers, that rely heavily on network servers for data storage, and that are developed and de- ployed differently from traditional desktop applications.
    [Show full text]
  • Protecting Browsers from Extension Vulnerabilities
    Protecting Browsers from Extension Vulnerabilities Adam Barth, Adrienne Porter Felt, Prateek Saxena Aaron Boodman University of California, Berkeley Google, Inc. fabarth, afelt, [email protected] [email protected] Abstract browser’s full privileges. If an attacker can exploit an ex- tension vulnerability, the attacker can usurp the extension’s Browser extensions are remarkably popular, with one in broad privileges and install malware on the user’s machine. three Firefox users running at least one extension. Although At this year’s DEFCON, Liverani and Freeman presented well-intentioned, extension developers are often not security attacks against a number of popular Firefox extensions [24]. experts and write buggy code that can be exploited by ma- In one example, if the user dragged an image from a mali- licious web site operators. In the Firefox extension system, cious web page into the extension, the web site operator these exploits are dangerous because extensions run with could install a remote desktop server on the user’s machine the user’s full privileges and can read and write arbitrary and take control of the user’s mouse and keyboard. files and launch new processes. In this paper, we analyze These attacks raise the question of whether browser ex- 25 popular Firefox extensions and find that 88% of these tensions require such a high level of privilege. To investi- extensions need less than the full set of available privileges. gate this question, we examine 25 popular Firefox exten- Additionally, we find that 76% of these extensions use un- sions to determine how much privilege each one requires.
    [Show full text]